Denial of service (DOS) and other Internet-based attacks waged from remote clients against servers, or other clients, have become notorious. These types of attacks can prevent access to e-mail, world-wide web (www) and/or other critical servers. Internet Service Providers (ISPs) are common targets for such attacks whereby, as a result, their mail and web servers can be rendered unavailable to their users for extended periods of time.
The Internet provides an extremely efficient and cost effective way for consumers of products and services, as well as users of information, to contact and interact with providers of that which they seek. The Internet works as well as it does, at least in part, because its data communication protocols (IP, TCP and UDP) have evolved over time. As a result, the protocols have developed a renowned robustness that makes user friendly. However, these protocols were designed with the basic assumption that all users, especially network administrators, operate with good-will. Unfortunately, this assumption does not hold true in today's Internet environment. A malicious person, equipped with a machine connected to the Internet and a modicum of protocol knowledge, can configure the machine to generate and deliver a large number of illegitimate requests to the servers, so many illegitimate requests that the servers become overloaded and cannot respond to legitimate requests.
One method by which the malicious individual can attack a server, for example a web server, is known as a “SYN” (synchronous) attack. A SYN attack is a denial of service attack that blocks other users from connecting to the target server. Details of a SYN attack are provided below.
The Internet protocol stack uses three layers of the Open System Interconnection (OSI) model. The lowest layer is the physical layer, and it contains the physical wires, network client adapter(s) and adapter device driver(s). The next layer is the data link layer, whose job is to read a stream of bits off the network and assemble them into frames for the next higher layer.
The Internet Protocol (IP) or network layer is the next layer. The IP packet is examined to ensure error free reception and the destination address field is evaluated to ensure that the packet is addressed to this station either directly as the end destination or indirectly if the station is a router, etc. The packet contents are further evaluated by the IP layer for a number of IP related activities, such as Address Resolution Protocol (ARP) or Internet Control and Message Protocol (ICMP).
If the packet is not one of the above formats, its contents continue to be evaluated as a Transmission Control Protocol (TCP) or User Datagram Protocol (UDP) packet. If the packet contains a TCP header, it is moved to the next higher (Layer 4) TCP layer for further processing to be conducted sometime in the future. In other words, it is at the IP-TCP boundary where information waits for processing based upon requests from programs that wish to communicate with the network. Therefore, the IP-TCP boundary contains a fixed amount of memory buffers allocated to network “activity”. It is at the TCP level that the SYN attack typically takes place. By sending many requests, the attacking client causes the attacked server to utilize much, or all, of its buffer space to store the “SYN attack” requests, thereby creating a lack of sufficient buffer space to store legitimate requests.
Steps for creating a connection require the client to request a “connect” which puts an IP packet in the server's IP-TCP boundary buffers. The server program requests a “listen”, then an “accept”. It is during these listen-connect-accept steps that TCP employs a “three-way handshake” to establish a connection. FIG. 2 illustrates a basic three-way handshake routine.
Six bits are defined in the TCP datagram header, two of which are the “SYN” (synchronize) and “ACK” (acknowledge) bits. When a client wishes to establish a connection with a server, or process, the client sends a datagram to the server with the SYN bit set and the ACK bit cleared, i.e., the first part of the three-way handshake. When the server receives the datagram, it reserves resources in its buffers and responds to the client with a separate datagram with both the SYN and ACK bits set, i.e., the second part of the three-way handshake. Typically, after the client receives the datagram from the server acknowledging that the server recognizes the desired connection, the client responds with yet another datagram wherein the SYN bit is cleared and only the ACK bit is set, i.e., the third and final part of the three-way handshake. When the server receives this last datagram from the client, the connection is established.
Under normal circumstances, connections to a server are established quickly, thus, only a few, i.e., ten, buffers are expected to be needed for all possible connections in the server. In a SYN-type denial of service attack, however, a program on a malicious user's client does not adhere to the SYN-ACK protocol; instead the program opens a raw network connection directly to the server and sends a burst of TCP SYN datagrams, ignoring any ACK replies from the target server. The buffers fill up quickly and the target server is unable to establish any subsequent connections, which denies service to legitimate users on other clients.
Typically, the upper limit for each program running on the server is ten un-ACK'd connection requests outstanding. When the backlog queue limit is reached, any attempts to establish other connections fail until a backlogged connection either becomes established (i.e., a SYN/ACK packet is ACK'd), reset (i.e., an RST packet is received) or timed-out (typically 75 seconds).
This situation can be made worse if the attacker inserts random IP source addresses, called IP “spoofing”, into each SYN datagram, thereby making it almost impossible for the server to trace the datagrams back to the real source. This type of DOS attack is referred to as a Distributed Denial of Service attack (DDOS) due to the distribution of the apparent attackers.
Several solutions, or at least partial solutions, to the SYN-type DOS attack already exist. For example, Cisco utilizes techniques within its routers to detect that a SYN-type attack is underway and then takes steps to prevent the attack. Detection of the attack is performed in one of two ways. The first method of detecting a SYN attack used by Cisco comprises comparing the rate of requests for new connections and the number of half-open connections to a configurable threshold level to detect a “flood” of SYN requests. When the router detects unusually high rates of new connections, it issues an alert message and then takes steps to control the flood. In accordance with a second method used by Cisco, all TCP connections are monitored to inspect packet sequence numbers in order to detect packet injections. If the packet sequence numbers are not within expected ranges, the router drops suspicious packets.
Once a SYN flood is detected, Cisco routers utilize one of two methods to prevent further flooding. The first method entails dropping old, half-open TCP connections to prevent system resource depletion. Instructing the server to clear out old connections prevents the system from overloading or shutting down. An administrator configures a maximum number of allowable half-open connections and a timeout value before half-open connections are deleted.
A second Cisco method comprises temporarily disabling or blocking all SYN request packets into the target server under attack to protect the router. This temporary blockage apparently keeps the rest of the system operating, although it disables the initiation of new, legitimate as well as malicious, connections to the server. An administrator can configure an automatic timeout period for the protected server to serve new connections again or the administrator can manually restart the router.
SYN-type flood attacks can also be detected by a “Firewall” placed between the server and the server's Internet router. For example, Checkpoint Software Technologies provides two software applications to be run on their Firewall products. As described in more detail below, the first software application counters the attack by ensuring that the three-way handshake is actually completed (i.e., the connection is a valid one) before sending a SYN packet to the desired destination of a connection.
The first Checkpoint application operates as follows. The Firewall intercepts a SYN packet destined for the server and does not pass the SYN packet to the server. Rather, the Firewall acts on the server's behalf and replies with a SYN/ACK packet to the client desiring the connection. Then, only if an ACK packet is received from the client does the Firewall send a SYN packet to the server. The server then replies to the SYN packet with a SYN/ACK sent to the Firewall and the Firewall replies to the remote server with an ACK. At this point the connection from the client to the server is established and the Firewall is able to begin passing data packets between the client and server.
One of the apparent capabilities of a Firewall running the application described above is the ability to translate the connection sequence numbers which are now different for each half of the connection, due to the intervention of the Firewall. Further, if the Firewall does not receive any response from either the client or the server for several seconds, or if it gets a RST when an ACK or a SYN/ACK is expected, it terminates the connection immediately.
Checkpoint's second software application also runs on its Firewall products and apparently alleviates problems associated with the technique of resetting the SYN connection as discussed previously. In order for the technique of resetting SYN connection attempts to be effective against SYN-type flood attacks, the reset timer must be small enough to keep the target server's backlog queue from filling up, while at the same time the timer must be large enough to allow users attempting to connect over a slow link to connect. Checkpoint addresses this problem by making sure that an ACK packet is sent in immediate response to the server's SYN/ACK packet. When the server receives the ACK packet, the connection is removed from the backlog queue and the connection becomes an open connection on the server. Since Internet servers can typically handle hundreds or thousands of open connections, the SYN-type flood attack is less effective in creating a denial of service condition at the server.
Another technique used to help prevent SYN-type flood attacks is the use of egress Hand ingress filtering. Egress filtering comprises imposing controls on the type of traffic permitted to leave a particular network. For example, the source address associated with network traffic should correspond directly to the location where it physically originated. Because routers at a client's Internet gateway can monitor this correspondence, or lack thereof, it is possible for these routers to detect potentially malicious traffic and prevent it from getting to the Internet and, hence, the target server.
At the receiving end of a connection, ingress filtering can also be employed. Ingress filtering is performed at the server's router or firewall and comprises denying access to all but a specified list of clients. This method assures that unknown or unverified users cannot connect to the target server, but it also prevents otherwise legitimate, but unknown, users from connecting as well.
The solutions described above all provide positive steps in preventing or at least diminishing the potentially devastating effects of a DOS attack. However, these measures are only a partial solution and the DOS attack will likely still succeed. Blocking the DOS source at the network equipment, i.e., at the access router or firewall, ensures that the targeted server will not crash. However, the DOS attack will still succeed because the access bandwidth to a website resident on the target server will be congested by the overload of illegitimate SYN requests. This overload prevents legitimate users from accessing the website.
While the SYN attack is one of the most common types of DOS attacks, there are a variety of others that also cause similar detrimental effects, such as the “PING O' DEATH,” which is an attack that takes advantage of a known bug in TCP/IP implementation. The attacker uses the “ping” system utility to make up an IP packet that exceeds the maximum number of bytes of data allowed by the IP specification. Systems simply crash or reboot themselves when they receive such an oversized packet.
Regardless of the type of attack that is waged, currently when an attack is detected, manual intervention is required. For example, the site administrator of the website resident on the target web server will alert the local Internet Service Provider (ISP) who will in turn alert other resources on the Internet to deny access to the sources of the attack. This is a slow manual process that relies on the skill of the site administrator. Furthermore, there is a danger that the often limited bandwidth connecting the website to the Internet could be blocked by the amount of data transferred in the attack. This prevents legitimate users from obtaining reasonable service.